Data Processing Agreement

1.1 We process personal data contained in the Content (Terms, Section 4.1) on the Customer’s behalf, only to provide the Service. Details are in Annex 1.

1.2 This DPA does not cover data for which we are controller ourselves: users’ accounts, sign-in and security data, organization memberships and invitations, as described in our Privacy Policy.

1.3 The DPA lasts as long as we process Content for the Customer, and ends with the deletion described in Section 9.

2.1 We process the Content only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s use and configuration of the Service (for example creating, changing, exporting or deleting data) are the Customer’s complete instructions. Further instructions must be agreed in writing (e-mail is enough).

2.2 We tell the Customer if we believe an instruction infringes data protection law.

2.3 We process Content beyond the Customer’s instructions only if EU or Polish law requires it; we then tell the Customer beforehand, unless the law forbids it.

Everyone we authorise to process Content is bound to confidentiality. Currently only the operator has access to production systems.

We take the technical and organisational measures in Annex 2. We may change them as long as the overall level of protection does not decrease.

5.1 The Customer gives general authorisation for the subprocessors listed in Annex 3.

5.2 We tell the owners of every organization by e-mail at least 30 days before adding or replacing a subprocessor. The Customer can object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer can end the Terms by deleting its organization, after exporting its data.

5.3 We bind every subprocessor by contract to data protection obligations at least as protective as this DPA, and remain responsible to the Customer for them.

The Content is stored in the EU (Frankfurt, Germany). Some subprocessors are companies based in the United States and may access data from there, for example for support or operations. Such transfers rely on the EU–US Data Privacy Framework where the subprocessor is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

7.1 Data subjects’ requests: the Customer can view, correct, export and delete Content itself in the Service. If a data subject contacts us about Content, we forward the request to the Customer without delay and do not answer it ourselves, unless the Customer instructs us to.

7.2 We help the Customer, as far as reasonable and with the information available to us, with data protection impact assessments and consultations with supervisory authorities.

8.1 We notify the organization’s owners without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Content.

8.2 The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available.

9.1 The Customer can export all Content at any time (Settings → Organization → Download all data) and delete it by deleting the organization.

9.2 When the Customer deletes its organization, or the Terms end, we delete the Content at once from the live database. It disappears from backups within 30 days, unless EU or Polish law requires us to keep it.

10.1 On request, we give the Customer the information needed to demonstrate compliance with Art. 28 GDPR, in particular a description of our measures and subprocessors.

10.2 If that information is not sufficient, the Customer may audit compliance, itself or through an auditor bound to confidentiality, at most once a year, with at least 30 days’ notice, during business hours and without disrupting operations. Audits of subprocessors take place through their own certifications and reports. The Customer bears its own costs; we may charge reasonable costs for our time beyond one working day per year.

11.1 Liability under this DPA follows the Terms (Section 9), except where Art. 82 GDPR provides otherwise.

11.2 The DPA is governed by Polish law. We may change it as described in Section 10 of the Terms; Section 5.2 applies to subprocessors.

Nature and purpose

Hosting, storing, displaying, comparing, versioning, exporting and backing up the Content, so the Customer can document its processes in the Service.

Duration

For the term of the Terms, plus up to 30 days for backups (Section 9).

Categories of data subjects

The Customer’s employees, contractors and other people the Customer names in its Content (for example requesters, implementers, process owners, approvers).

Types of personal data

Names and roles of people mentioned in diagrams, comments and change records; authorship and approval of versions (who saved, approved or published which version, and when); links to the Customer’s own systems (for example ticket URLs), which can identify people. The Service is not designed for special categories of personal data (Art. 9 GDPR), and the Customer should not store them in it.

Frequency

Continuous, while the Service is used.

Encryption

• All connections to the Service are encrypted with TLS; HTTPS is enforced (HSTS).
• The database and its backups are encrypted at rest by the hosting provider.

Separation of customers

• Every organization’s data is separated in the database by row-level security, enforced by the database itself for every query, in addition to checks in the application.
• Automated tests check this separation for every table.
• The application connects with a database role that cannot bypass this separation.

Access control

• Users sign in with e-mail and password. Passwords are stored only as salted hashes, and e-mail addresses must be confirmed.
• Roles within each organization (viewer, modeler, approver, admin, owner) limit who can change, approve, publish or delete data. Owners and admins manage members.
• Access to production systems is limited to the operator and protected by two-factor authentication.

Protection against abuse

• Sign-in, sign-up and password reset are rate-limited and protected by a bot check (Cloudflare Turnstile).
• Security headers include a Content Security Policy.

Integrity and history

• Saved diagram versions cannot be changed, which is enforced by the database. Every change creates a new version, and the publishing workflow is recorded.

Availability and recovery

• Point-in-time recovery covers 7 days, and daily snapshots are kept for up to 30 days.
• Restoring is tested and documented.

Data minimisation and deletion

• No analytics, advertising or tracking.
• Customers can export and delete their data themselves at any time.

Development

• Changes are version-controlled and checked by automated tests before deployment.
• Dependencies are kept up to date.

Vercel Inc., USA

Hosting of the application. Application servers in the EU (Frankfurt, Germany); requests pass through Vercel’s global network.

Neon Inc., USA

Managed PostgreSQL database and its backups. Data in the EU (AWS Frankfurt, Germany).

Resend (delivery of account and invitation e-mails) and Cloudflare (name servers and the bot check on the sign-in forms) are used for the Service but do not receive Content, so they are listed in the Privacy Policy rather than here.